Actively exploited in the wild
TeleMessage TM SGNL Hidden Functionality Vulnerability
TeleMessage - TM SGNL · Listed in the CISA KEV since 2025-05-12. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-47729
LowCVSS 1.9KEVSummary
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (Archive Signal) app users, contrary to the documented end-to-end encryption. This was exploited in the wild in May 2025.
Risk Assessment
Confidential user messages are stored without encryption, potentially leading to data leaks and privacy breaches.
Recommendation
Update TeleMessage to a version after 2025-05-05 or discontinue use until a fix is available.
Other vulnerabilities in TeleMessage
See all- CVE-2025-48928MediumActively exploited
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
- CVE-2025-48927MediumActively exploited
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
Original NVD description (English source)
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.